What to Do When a Major Client Sends an Anti-Bribery Questionnaire

For many companies in Egypt and the wider region, the first serious conversation about anti-bribery controls does not come from a regulator. It comes from a client. A multinational buyer, a development finance institution or a large local group sends a supplier onboarding pack, and somewhere inside it is a questionnaire on bribery and corruption.

The reaction is often a mix of surprise and concern. The company has never paid a bribe and does not see itself as a risk. Yet the questions ask for policies, training records, due diligence files and reporting channels that may not exist in written form.

This article explains why these questionnaires arrive, what they usually ask, and how to respond in a way that protects the relationship and strengthens the business.

Why large clients send them

A large client is not only buying your product or service. Under several legal regimes, it may also be taking on risk from the way you conduct business on its behalf.

The UK Bribery Act 2010 includes an offence where a commercial organisation fails to prevent bribery by a person associated with it. It is a full defence for the organisation to show it had adequate procedures in place. The Ministry of Justice guidance on adequate procedures sets out six principles: proportionate procedures, top-level commitment, risk assessment, due diligence, communication (including training), and monitoring and review. Due diligence on those who perform services for or on behalf of the organisation is one of them.

In the United States, the Resource Guide to the Foreign Corrupt Practices Act, published by the Department of Justice and the Securities and Exchange Commission, makes clear that a bribe paid through a third party does not remove the potential for liability. The Department of Justice's Evaluation of Corporate Compliance Programs states that a well-designed compliance programme should apply risk-based due diligence to its third-party relationships.

Many organizations also align their programmes with ISO 37001, the international standard for anti-bribery management systems, which includes due diligence procedures among its components.

The result is simple. When your client sends a questionnaire, it is usually doing what its own legal advisers, auditors or standards require. It is not an accusation. It is part of the client's own compliance programme, and you are one of its third parties.

What the questionnaire usually asks

Questionnaires vary in length and style, but most cover similar ground:

• Policy. Do you have a written anti-bribery and anti-corruption policy? Who approved it, and when was it last reviewed?
• Gifts and hospitality. Do you have rules on giving and receiving gifts, meals, travel and entertainment? Is there a register?
• Third parties and agents. Do you use agents, distributors, consultants or sub-contractors? How do you select and monitor them?
• Government officials. Do you interact with public officials, state-owned companies or regulators? Are any owners, directors or senior staff current or former officials, or related to one?
• Training. Have employees and managers been trained on bribery risks? Can you show records?
• Whistleblowing. Is there a confidential channel for reporting concerns, and are reporters protected from retaliation?
• Investigations and history. Have you or your senior people been investigated, charged or sanctioned for bribery, fraud or related offences?
• Beneficial ownership. Who ultimately owns and controls the company?

Some questionnaires add questions on sanctions, facilitation payments, political and charitable contributions, books and records, and conflicts of interest.

Why honest answers matter more than perfect answers

There is a temptation to tick every box. That is a mistake.

The client's compliance team reviews many suppliers. Experienced reviewers can tell the difference between a small company that is honest about where it stands and one that claims a complete programme with nothing to show for it. Answers may be checked later through audit rights in the contract, requests for evidence, or interviews. An inaccurate answer creates a far bigger problem than a gap that was declared openly.

An honest "not yet, but here is our plan and timeline" is often acceptable, especially for a lower-risk supplier. A confident "yes" that cannot be supported may lead to termination, and in some cases to contractual or legal consequences. Because the questionnaire may become part of the contract record, it is sensible to have a lawyer review your answers where the stakes are significant or where you are unsure how a question should be read.

Prepare before the questionnaire arrives

The best time to prepare is before the request lands. Three elements make the difference.

1. Evidence. For each likely question, know what document or record would answer it: the approved policy, the board minute that approved it, the gifts register, training attendance lists, the whistleblowing procedure, third-party due diligence files, and ownership records.
2. Owners. Assign a person to each area. Someone must own the policy, someone must keep the gifts register, and someone must be able to explain how agents are selected. In smaller companies, one senior person may hold several of these roles, and that is fine if it is clear.
3. A minimum viable programme. You do not need a large compliance department. You need a proportionate set of controls that fits your size and risk: a clear policy endorsed by leadership, a short risk assessment, simple rules for gifts and hospitality, basic checks on agents and intermediaries, a reporting channel, initial training, and a routine for review.

It also helps to keep a standard response pack: a short company profile, ownership structure, the policy, and a summary of controls. This saves time and gives consistent answers across clients.

A 30/60/90-day plan

If a questionnaire has just arrived, or you expect one soon, the following plan offers a realistic path.

First 30 days: understand and respond honestly

• Name a senior owner for the response and for the wider programme.
• Read the questionnaire carefully and list every question that requires evidence.
• Gather what already exists, including informal practices that can be written down.
• Answer accurately. Where something is missing, say so and describe the planned action and date.
• Ask for legal review of the answers where the contract value or risk is significant.

Days 31 to 60: build the essentials

• Carry out a short bribery risk assessment covering markets, customers, government touchpoints and third parties.
• Draft and approve an anti-bribery policy with clear rules on gifts, hospitality, facilitation payments and conflicts of interest.
• Set up a gifts and hospitality register and a simple approval route.
• Introduce basic due diligence for agents, distributors and consultants, scaled to risk.
• Establish a confidential reporting channel and a non-retaliation commitment.

Days 61 to 90: embed and evidence

• Train managers and staff in higher-risk roles, and record attendance.
• Add anti-bribery clauses to contracts with key third parties.
• Brief the board or owners and record their endorsement.
• Assign responsibility for monitoring and agree a date for the first review.
• Update your standard response pack so that the next questionnaire takes days, not weeks.

A commercial advantage, not only a burden

A questionnaire can feel like administration. In practice, it is a signal of where your market is moving. Clients, lenders and investors increasingly expect suppliers to show that integrity is managed, not assumed. A company that can answer clearly and back its answers with evidence becomes an easier partner to choose and to keep.

Darwish & Co.'s Integrity & Anti-Corruption practice, part of our Governance & Risk work, helps companies respond to client due diligence requests, assess bribery risk, and build proportionate anti-bribery programmes that hold up under review. Where questions raise legal issues, we work alongside your legal advisers.